Chronos Payroll ("Chronos," "we," "us") provides payroll processing, tax filing, and workforce compliance software to businesses ("Vendors") and their employees and contractors. This policy explains what information we collect, how we protect it, and the choices you have.

1. Information We Collect

To run payroll and file taxes accurately, Chronos collects and stores:

• Identity & contact information - name, address, phone, email, date of birth.
• Government identifiers - Social Security Numbers (employees) and Tax Identification Numbers (contractors), required for tax withholding and IRS/state filings.
• Payroll & tax data - pay rate, filing status, W-4/state withholding elections, hours worked, and the resulting wage and tax figures on every pay run.
• Banking information - account and routing numbers, used solely to process direct deposit.
• Account credentials - login email and a securely hashed password (we never store passwords in plain text).

2. How We Protect It

• Encryption at rest. Social Security Numbers, Tax ID Numbers, and bank account/routing numbers are individually encrypted in our database - not just the database as a whole.
• Multi-factor authentication. Every login - for vendors, administrators, and employees alike - requires a one-time verification code in addition to a password.
• Tamper-evident audit logging. Security-relevant actions (logins, MFA events, changes to sensitive records) are recorded in an append-only, cryptographically chained log that reveals if any entry is altered after the fact.
• Role-based access. A vendor's staff can only see their own company's records; an employee using self-service can only ever see their own pay stubs, forms, and tax settings.
• Least-privilege data handling. Payroll processing code works with encrypted fields transparently and only decrypts what a specific screen or report actually needs to display.

3. How We Use Your Information

We use the information above only to: run payroll and calculate withholding; prepare and file required tax forms (W-2, 1099, 940, 941, and state equivalents) with the IRS and state tax/unemployment agencies; process direct deposit; and maintain the records employers are legally required to keep.

We do not sell personal information, and we do not use it for advertising.

4. Who We Share It With

Information is shared only where necessary to do the job above: with the IRS and state tax/labor agencies (for required filings), with our payment processor (for billing), and with our hosting/infrastructure providers (who store data on our behalf under contract, and do not use it for their own purposes).

5. Your Rights

An employee or contractor can ask their employer (a Chronos Vendor) what personal data Chronos holds about them. Every Vendor account includes a Data Subject Access Request tool built for exactly this purpose, so requests are logged and answered directly from their own payroll records.

6. Data Retention

Payroll and tax records are retained for as long as required by federal and state recordkeeping law (generally a minimum of four years for employment tax records), and for the duration of the Vendor's use of Chronos thereafter unless deletion is requested and legally permissible.

7. Cookies

Chronos uses only the session cookies necessary to keep you signed in securely. We do not use advertising or third-party tracking cookies.

8. Changes to This Policy

If this policy changes materially, we will update the date at the top of this page.

9. Security Incident Reporting

If a security incident ever affects your data, our response and reporting process is documented in our Security Incident Response Policy.

10. Contact Us

Questions about this policy or a privacy request can be sent to info@chronospayroll.com.